CVE-2023-1162

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1162
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument password leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:M/C:C/I:C/A:C

Exploitability : 6.4 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://github.com/xxy1126/Vuln/blob/main/Draytek/2.md Exploit
https://vuldb.com/?ctiid.222258 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.222258 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:draytek:vigor_2960_firmware:1.5.1.4:*:*:*:*:*:*:*
cpe:2.3:h:draytek:vigor_2960:-:*:*:*:*:*:*:*
History

22 Nov 2023, 21:15

Type Values Removed Values Added
Summary A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4. Affected is the function sub_1225C of the file mainfunction.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument password leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222258 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

10 Mar 2023, 18:59

Type Values Removed Values Added
References (MISC) https://github.com/xxy1126/Vuln/blob/main/Draytek/2.md - (MISC) https://github.com/xxy1126/Vuln/blob/main/Draytek/2.md - Exploit
References (MISC) https://vuldb.com/?id.222258 - (MISC) https://vuldb.com/?id.222258 - Third Party Advisory, VDB Entry
References (MISC) https://vuldb.com/?ctiid.222258 - (MISC) https://vuldb.com/?ctiid.222258 - Permissions Required, Third Party Advisory, VDB Entry
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Draytek vigor 2960
Draytek
Draytek vigor 2960 Firmware
CPE cpe:2.3:h:draytek:vigor_2960:-:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigor_2960_firmware:1.5.1.4:*:*:*:*:*:*:*

03 Mar 2023, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-03 07:15

Updated : 2024-04-11 01:17

NVD link : CVE-2023-1162

Mitre link : CVE-2023-1162

CVE.ORG link : CVE-2023-1162

JSON object : View

Products Affected

draytek

  • vigor_2960_firmware
  • vigor_2960
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')